Analysis
-
max time kernel
120s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
18-11-2024 21:24
Behavioral task
behavioral1
Sample
a6e8c7f2eeae4c3716aeb7572ded8654ebe26ffc883910f71cb0c76e7843179cN.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
a6e8c7f2eeae4c3716aeb7572ded8654ebe26ffc883910f71cb0c76e7843179cN.exe
Resource
win10v2004-20241007-en
General
-
Target
a6e8c7f2eeae4c3716aeb7572ded8654ebe26ffc883910f71cb0c76e7843179cN.exe
-
Size
29KB
-
MD5
8ed36e48098b615a2f1ad1263c605260
-
SHA1
cffa56c444f8cdfe9e7ffb7eeb1941ee37d50382
-
SHA256
a6e8c7f2eeae4c3716aeb7572ded8654ebe26ffc883910f71cb0c76e7843179c
-
SHA512
84bb5e85c48bef2fab247d37d2f240888f5550174c95f2b96216e90f4f392f17c044a8c26540f079e28ae91b0196cba3647c0eeaf21b261029ba10d6ab378832
-
SSDEEP
768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/OuN:AEwVs+0jNDY1qi/qL
Malware Config
Signatures
-
Detects MyDoom family 3 IoCs
resource yara_rule behavioral1/memory/2308-17-0x0000000000500000-0x0000000000510200-memory.dmp family_mydoom behavioral1/memory/2308-57-0x0000000000500000-0x0000000000510200-memory.dmp family_mydoom behavioral1/memory/2308-62-0x0000000000500000-0x0000000000510200-memory.dmp family_mydoom -
Mydoom family
-
Executes dropped EXE 1 IoCs
pid Process 1812 services.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe" a6e8c7f2eeae4c3716aeb7572ded8654ebe26ffc883910f71cb0c76e7843179cN.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe" services.exe -
resource yara_rule behavioral1/memory/2308-0-0x0000000000500000-0x0000000000510200-memory.dmp upx behavioral1/files/0x000800000001739c-6.dat upx behavioral1/memory/1812-11-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral1/memory/2308-17-0x0000000000500000-0x0000000000510200-memory.dmp upx behavioral1/memory/2308-18-0x0000000000220000-0x0000000000228000-memory.dmp upx behavioral1/memory/1812-20-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral1/memory/1812-22-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral1/memory/1812-27-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral1/memory/1812-32-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral1/memory/1812-34-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral1/memory/1812-39-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral1/memory/1812-44-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral1/memory/1812-46-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral1/memory/1812-51-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral1/memory/1812-56-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral1/memory/1812-58-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral1/memory/2308-57-0x0000000000500000-0x0000000000510200-memory.dmp upx behavioral1/memory/1812-63-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral1/memory/2308-62-0x0000000000500000-0x0000000000510200-memory.dmp upx behavioral1/files/0x0005000000004ed7-73.dat upx -
Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\java.exe a6e8c7f2eeae4c3716aeb7572ded8654ebe26ffc883910f71cb0c76e7843179cN.exe File created C:\Windows\java.exe a6e8c7f2eeae4c3716aeb7572ded8654ebe26ffc883910f71cb0c76e7843179cN.exe File created C:\Windows\services.exe a6e8c7f2eeae4c3716aeb7572ded8654ebe26ffc883910f71cb0c76e7843179cN.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a6e8c7f2eeae4c3716aeb7572ded8654ebe26ffc883910f71cb0c76e7843179cN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language services.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2308 wrote to memory of 1812 2308 a6e8c7f2eeae4c3716aeb7572ded8654ebe26ffc883910f71cb0c76e7843179cN.exe 31 PID 2308 wrote to memory of 1812 2308 a6e8c7f2eeae4c3716aeb7572ded8654ebe26ffc883910f71cb0c76e7843179cN.exe 31 PID 2308 wrote to memory of 1812 2308 a6e8c7f2eeae4c3716aeb7572ded8654ebe26ffc883910f71cb0c76e7843179cN.exe 31 PID 2308 wrote to memory of 1812 2308 a6e8c7f2eeae4c3716aeb7572ded8654ebe26ffc883910f71cb0c76e7843179cN.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\a6e8c7f2eeae4c3716aeb7572ded8654ebe26ffc883910f71cb0c76e7843179cN.exe"C:\Users\Admin\AppData\Local\Temp\a6e8c7f2eeae4c3716aeb7572ded8654ebe26ffc883910f71cb0c76e7843179cN.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2308 -
C:\Windows\services.exe"C:\Windows\services.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:1812
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
29KB
MD5b1068b266652d0675f1d802381f8bcbe
SHA191eac2fbe4063e54cc7a48d0a011a608eb91eeac
SHA256597a997f046c44989dbd2d53e8b02a3b8351b1dbca279880c1ca666d452bbf24
SHA512811477bd4f016334b1c677e4b5343bf28daffb274a2705b04815bb3bc01e6d5fbe9f396e3455550580ca74032f7491de03977e136519e3b32e4d0ef0d404d0d0
-
Filesize
352B
MD5663818684f917a2fcf2b0db1e28a5117
SHA180babecee020b8d35f8ccc0dce0ab9c3cd6a3c7f
SHA256fc2d5513507027fa9c06984f6dce65b35e8b4b7459533a0f9ef922301ac071c5
SHA5127da133ded20ed259bf9a214fa08c473592680d02f0f0633caaf5f1639a2674ff4738271855ac3c7eeb342ed3f6ff81639e428e5bccfaae964c6e65c4f4990e1e
-
Filesize
8KB
MD5b0fe74719b1b647e2056641931907f4a
SHA1e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA5129c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2